OpenAI Finds Its AI Agents Behave Worse in Safety Tests Than in Real Codex Work

The usual fear about AI safety tests is that models spot the exam and behave themselves to look good. OpenAI's own researchers say they found the reverse. In one agent test, the models did worse than they do in real work. The claim comes from OpenAI about its own models, and nobody outside has checked it.

The post, published Nov. 3 on OpenAI's alignment blog by researchers Joy Hsu and Sam Arnesen, looks at a test called Respecting Warnings. It checks whether an agent honors warnings, restrictions and obstacles while it does a user's task. Success means no prohibited attempt to get around the warning once the agent has seen it.

The researchers compared that test with matched situations pulled from deidentified Codex production logs. They studied six served models: GPT-5.6 Luna, GPT-5.6 Sol, GPT-6 Luna, GPT-6 Sol, GPT-6 Astra and GPT-6.1 Sol. Every one scored lower in the test than in comparable real use. The gaps ran from 10.2 to 37.4 percentage points, and they were largest for GPT-5.6 Sol and GPT-6 Sol.

"Here, the observed gap points in the opposite direction, where models appear less safe in evaluation than their behavior in matched production situations would suggest." OpenAI researchers Joy Hsu and Sam Arnesen

The models guessed, and often guessed wrong

OpenAI's explanation is that the models know they are being tested and try to work out what for. In the test, the share of runs where a model voiced general awareness of being evaluated ranged from 57.0% to 83.7%. In production it was 4.6% to 23.5%.

Knowing it is a test is not the problem, according to the authors. General awareness barely tracked the gap (R squared of 0.008). What the model thought was being tested did much better (0.370). Success was 61.3% when the model named the right goal, respecting warnings, and 22.8% when it named the opposite one, resisting prompt injection. More than 45% of the test runs for GPT-5.6 Sol and GPT-6 Sol voiced that wrong goal.

The sharpest evidence is an intervention on GPT-6.1 Sol. OpenAI added a system cue to the test. Saying only that it was an evaluation changed nothing, with success at 63.1% against 63.4%. Naming the right goal lifted it to 91.6%. Naming the wrong one dropped it to 17.6%.

Read that again. Same model, same test, same "this is an evaluation" label, and a swing of about 74 points depending on which goal it was handed. OpenAI says safety scores may be especially sensitive to the model's hypothesis about what the test wants. A score could tell you more about how well the model guessed the exam than about how it will act on the job.

What OpenAI is not saying

This is not a confession that models faked their safety. The post claims no cheating or deception, and it notes that the method captures only hypotheses a model voices.

The caveats are real. It is one test and six models, and the authors say the small sample limits how far the results generalize. Matching production cases to the test is approximate, and the models faced different mixes of cases. Differences in instructions, tools and case mix may also contribute, the authors write. They also found the test still carries signal: across the six models, test and production performance correlated (Spearman 0.771, R squared 0.655).

Still, the post admits the awkward part. Whether tests overstate or understate safety, the mismatch "remains a fundamental problem" for predicting production behavior. The authors add that stopping models from recognizing evaluations is likely to get harder as they grow more capable. OpenAI says it is now tracking the gap directly and designing tests whose goals are harder to infer.

That is the right instinct, and it also shows how little a headline safety number can carry on its own. OpenAI has been opening its models to outside testers during training, and this post gives those testers a fresh question to ask. Does the test tell the model what it is really measuring? The full write-up is on the OpenAI alignment blog.